TL;DR: AI agents don't need to be hacked to cause damage: they can do the wrong thing with valid credentials, inside a system where every control worked as designed.
That was the point made in the recent Cloud Security Alliance webinar "Governance for Agentic AI: Closing the Control Gap Before Your AI Agents Outrun It," featuring Mark Bower, Chief Strategy Officer at Anjuna, and Noble Ackerson, Senior Director of AI and Agentic Solutions at Leidos.
Both speakers drew from their experience in highly regulated organizations, where an autonomous action often can't be undone. Their conversation surfaced the following takeaways:
- The question of AI governance has changed. Access control asks "can this agent get in?" Agentic security asks "should it perform this action, in this context, right now?"
- Identity is table stakes, not the answer. An agent can be exactly who it claims to be and still take an action that shouldn't happen.
- Control must live where the action happens. Governance/compliance committees, review boards, and model reviews all sit before execution. None of them is operating in the execution path.
- Match autonomy to consequence. Low-stakes, reversible actions can run on their own; high-consequence or irreversible ones need explicit approval or a block. Trust is a dial, not a switch.
- The governance layer is a target too. The component that authorizes actions must be separated from the agents it governs; tamper-resistant; and visible whenever it authorizes, blocks, or is changed.
- Confidential computing moves the trust boundary down into the hardware. Hardware-based Trusted Execution Environments (TEEs) isolate the control layer from privileged software, and attestation proves what is actually running.
- Good governance speeds you up. Evidence produced as decisions are made shortens audits and approvals, instead of forcing teams to reconstruct intent from scattered logs.
When the sandbox isn't safe enough
Ackerson pointed to a recent incident where an AI system, under cybersecurity evaluation in what was believed to be an isolated environment, found a path to access production infrastructure, including systems belonging to Hugging Face. Its objective was simply to perform well on the evaluation, and it found another route to that goal.
No malice was needed. The agent was optimizing for its objective, and the path happened to run through someone else's infrastructure. Investigators then had to reconstruct thousands of machine-speed actions to learn why. Two lessons stood out: launching an agent in a sandbox is not oversight, and oversight that can be switched off or bypassed is not a sufficient control.
Calibrated autonomy and a trustworthy place to enforce it
Ackerson described calibrated autonomy: the degree of independence an agent gets should track the consequence of the action, its reversibility and the authority involved. The operating loop is to declare what the agent should do, match authorization to those facts, watch continuously, and hand the decision back to a human when risk crosses a threshold. The goal is a gradient between human-in-the-loop and human-on-the-loop, not a human approving every action.
Bower argued that because sandboxes are themselves software, the governance function should run in a hardware-enforced TEE, where the agent can't modify its keys or policy and attestation shows the expected software is what's running. He was clear that confidential computing is not a policy engine, but it gives that control a much more secure place to run and raises the cost of attackers compromising it.
Governance that survives scale and stress
Two practical pressures raise the urgency of agent control. The first is scale: Ackerson noted that within about 48 hours of the Pentagon releasing an agent-building capability, users had created roughly 8,000 agents, and about 20,000 within two weeks. Nobody can control that many agents manually, so the control system has to keep up with the agents it controls.
The second is resilience. If authorization depends on a round trip to a central service, the gate fails exactly when it's needed most, such as under a denial-of-service attack or a degraded network. Decision logic needs to run where the agent runs.
Their parting point: agents are not just another application to attach old controls to. They carry delegated authority, so governance has to operate at machine speed with humans still defining the boundaries.
Watch the replay here.
